What this standard answers
- Which DLP-relevant controls are active today
- Which policy artifacts are still being formalized
- How this standard should be interpreted during review
Current state (as of March 5, 2026)
Core preventive controls are implemented through product design and access controls. Formal policy mapping is in progress.Current control baseline
| Area | Current control |
|---|---|
| Data minimization | Product design limits persistent storage scope |
| Access control | Tenant and role-scoped authorization model |
| Secrets protection | Managed secret systems and restricted access |
| Transport and storage | Encryption in transit and at rest |
| Monitoring | Security and operational event monitoring |
In progress
- Formalized DLP policy mapping and control-to-evidence matrix completion.
- Target completion: March 2026.